chore(deps): Update GitHub Actions

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Pending
arillso/.github	action	minor	2026-06-18 → 2026-08-07	2026-08-09 (+1)
python	uses-with	patch	3.14.6 → 3.14.7

---

Release Notes

arillso/.github (arillso/.github)

v2026-08-07

Compare Source

Added

• self-pull-request.yml, self-merge.yml, self-weekly-security.yml:
  This repository now runs its own CI, mirroring sbaerlocher/.github. Until
  now every workflow here was workflow_call-only and nothing verified the
  repository itself. Each new workflow calls this repo's own reusables through
  a local ./ path, so the workflows consumers depend on are exercised before
  they ship.
• self-merge.yml: Moves the YYYY-MM-DD date tag to the newest commit on
  main, forward-only and serialised via concurrency: date-tag. Tagging was
  manual before; the newest tag was 2026-06-18, which is exactly what the
  consumer repositories pin — so fixes merged after that date never reached
  them without a hand-cut tag.

Changed

• ai-claude-review.yml: Dropped the pull_request: trigger; the workflow is
  now workflow_call-only like every other reusable here, and
  self-pull-request.yml invokes it. Note that this does not change the
  claude-code-action workflow-validation guard: it checks every workflow file
  taking part in a run against the default branch, so a PR modifying this file
  still has its review skipped regardless of where the trigger lives.

Fixed

• workflows/security-code.yml: Caller inputs (paths-ignore,
  package-manager, build-command) and the step summary values were expanded
  by the workflow parser into run: bodies, so a value carrying a command
  substitution executed on the runner with security-events: write. They now
  travel through env: and are read as shell variables; the summary heredoc is
  replaced by printf.
• ai-claude-review.yml: Read REVIEW.md, AGENTS.md and CLAUDE.md from
  the base ref instead of the PR's own checkout. A PR that changed these files
  rewrote the instructions of the agent reviewing it, while that agent holds
  gh pr review --approve. A second sparse actions/checkout provides them
  under .review-base/, and the prompt now reads only from there.

Changed

• workflows/security-code.yml: package-manager is restricted to
  npm | pnpm | yarn. Its value leaves the step through $GITHUB_OUTPUT and is
  interpolated into a second run: body, so an unconstrained string would
  execute there. Any other non-empty value now fails the step; lock-file
  detection is unchanged when the input is empty.
• pull_request_template.md, templates/pull_request_template.md:
  Generalize the org-wide PR template. The fixed role checklist (Alloy, DO,
  Tailscale) came from ansible.agent and was meaningless in every other
  repository the template applies to — it is now a free-form
  ## Affected Component(s) list. Removed the trailing comment block, which
  thanked contributors for the wrong repository and carried an attribution
  line the commit conventions forbid; every PR in the organization inherited
  both.

Removed

• workflows/release-go.yml: The pre-build-commands input is removed. It
  was expanded into a run: body in the job holding contents: write,
  packages: write and GITHUB_TOKEN, and no caller sets it.

Migration notes

• Breaking: callers that passed pre-build-commands to release-go.yml must run
  those commands in their own job before calling the workflow.
• Callers passing a package-manager other than npm, pnpm or yarn to
  security-code.yml will now see the run fail instead of the value being used.

actions/python-versions (python)

v3.14.7: 3.14.7

Compare Source

Python 3.14.7

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.